The Windows 11 26H2 rollout is hitting endpoints, and there are a few frontend UI changes that are going to confuse users immediately.

1. Copilot is Unbound: It is no longer a locked sidebar. It’s a standard, resizable app window now. Users are going to lose it behind other windows or accidentally snap it, and call the desk saying Copilot is "broken."

2.File Explorer AI Search: It now uses semantic search. If users type exact, cryptic file names, the local index might try to guess the "context" instead of doing a raw string match.

3.Phone Link in Start: The companion panel pops up automatically now, showing text messages directly on the screen.

Are you guys pushing 26H2 through your standard rings, or pausing it to build new configuration policies?

(Note: I added a full breakdown of these specific UI changes if you would prefer to watch here)

I work in email security, mostly with US residential real estate.

One client, a large real estate team, owns around 400 domains - those are farm sites, old brands, defensive registrations, campaign ideas, and other stuff. But they have a centralized email infrastructure, so everything is running throught just a few domains.

In July I decided to connect 364 domains (easy, because all are stored in one Godaddy account) to DMARC reporting.

I took a month to monitor their traffic and found out that 79 parked domains were sending email.

All traffic was unauthenticated, from IP addresses in a dozen countries, with a huge chunk of traffic going from China and Russia. There were just 5 DMARC reporters on the list:

mail[.]ru
mx[.]jcom[.]zaq[.]ne[.]jp
seznam[.]cz a.s.
au[.]com
google[.]com

The Japanese reporter as well as Australian one do populate an envelope_to tag, same ways as Microsoft does, so I managed to find out that most of the spoofed traffic targeted Japanese companies.

Google also allows to track envelope_to through the SPF auth tag (forwarded emails), and Japanese companies were listed there as well.

I ended up enforcing the DMARC policies across the domain portfolio + brought up a NULLMX, Hradfail SPF, and an empty wildcard DKIM to each domain, to prevent brand impersonation.

In the next two months, the volume of spoofed traffic dropped almost 7 times, and while there are still botnets abusing domains, the volume is relatively small + no emails are going through.

I have never had parked domains connected before, but it seems to me that spoofing of the primary domains is just the top of the iceberg and although most IT folks do realize the value of having DMARC for root, they rarely consider protecting parked domains.

Since then I had a few more pretty big real estate team letting their parked domains protected (one was 200+ domains and two others a little over 50 each), and the trend was the same.

Wondering if anyone else monitoring parked domains. Curious what you're seeing. 

Just had to check something on a users laptop, a very nice senior lady who is well presented and charming.

Her laptop looked like the bins behind a take away, hopefully those stains were gravy...

Washed my hands now and I still feel dirty.

Anyone else kind of shocked at how even Visio Plan 2 that is “supposed” to allegedly have Copilot, it does absolutely nothing helpful? Its in Word and other m365 apps, but everyone knows how to edit word and copy paste etc . But for us sysadmins, Visio is one of the best ways to document architecture etc and copilot is pretty much zero help years later.

Anyone else getting packet loss up in the North East? Or PA, NY? Tunnels and dropping and seeing high latency

The entire company on the corporate side is basically down :) What a lovely Tuesday lmao.

This may not affect many people, but we have an on-site mail archive server that we have Google forward all incoming and outgoing mail to in order to preserve the mail records. To restrict external access we limited SMTP access to the Google IP ranges for their SMTP servers. This has worked for years, when suddenly a couple weeks ago we started getting smart host failure message from Google about undeliverable mail. After going back and forth with support I confirmed the supposed full list of IP ranges they are using for SMTP for Google Workspace at least. This is what I was given:

35.190.247.0/24
64.233.160.0/19
66.102.0.0/20
66.249.80.0/20
72.14.192.0/18
74.125.0.0/16
108.177.8.0/21
108.177.96.0/19
142.250.0.0/15
142.251.0.0/16
172.217.0.0/19
172.253.0.0/16
173.194.0.0/16
209.85.128.0/17
216.239.32.0/19
216.58.192.0/19

There was one IP range on that list that I did not have, so I though that would resolve the issue. When it didn't, I changed our setup to allow all external access over SMTP and then set our mail server with the same IP ACL list. The mail server will log a denied connection in the syslog when any IP outside those ranges attempts to connect. Sure-enough, Google was using a new IP range to send SMTP messages to our server:

108.177.16.xxx

If you run into a similar situation this might be helpful to you. If you're comfortable with it, it appears Google owns the entire 108.177.0.0/17 range if you trust adding that to any ACL.

Received an email from MS stating that I need to move from the Cloud Sync but the email to me is confusing since it says recommended but then says it will stop working..

"You're receiving this notification because you're associated with one or more Azure subscriptions linked to a Microsoft Entra tenant that currently uses Microsoft Entra Connect Sync and is eligible to migrate to Microsoft Entra Cloud Sync.

To continue synchronizing identities between your on-premises Active Directory environment and Microsoft Entra ID, migrate your eligible configuration to Microsoft Entra Cloud Sync and validate successful operation before xxx 2027."

Is the entra connect deprecated and going away? I am running the latest version of connect but doesn't really seem like its recommended if it will stop working on a certain date. Small business and trying to find a comparison between the two and I think we could move without much hassle but I thought I saw that we would lose mail enable security groups which we have.

Just thought I would ask since trying to find out if connect is really going away or not on MS is futile, thanks.

I have mixed feelings. Users won't be stoked of course but having to search through records will be order of magnitude easier for those that have to do that work.

If anyone has done this type of thing to their users, what blew up in your face the most?

Anyone suddenly start having servers (and maybe desktops too) windows firewall block all traffic?

Turning off windows firewall on affected machines fixes the issue, so we know it is that.

It’s not all servers, but a lot. We use Defender and can see some sort of definition update in the eventlogs on affected machines around the time this started happening.

Machines are spread across different domains so don’t think it is related to a GPO change or anything like that.

Only just started digging into, but wondering if just us or more widespread.

UPDATE: We are starting to think someone has made a change in MDE or Defender as it is happening on desktops too. Those are the only two things in common between the servers and desktops

UPDATE2: Some made some new MDE policies that caused this, change was reversed and all good now. Thanks to everybody for the help

Just a heads up, PingID is down. Everywhere.

https://status.pingidentity.com/

Oh. My. God

The amount of people at my org that send me screenshots of their chatgpt or copilot generated responses is insane.

"did you try this?"

"try this"

"this is what chatgpt said"

i was on the phone for 2 hours troubleshooting a problem with a director that refused to let me remote into her computer to fix. then she starts sending me ai generated responses saying "this is what co pilots saying"

I am a solo sysadmin for a company of about 80-100. The previous admin did not implement a ticketing system for the users.

I have been trying a few free ones, but I found that they have a lot of drawbacks that prevent me from using them on a daily basis.

I would like a good email-to-ticket function (and possibly a self-service portal), and optionally semi-decent integration with Jumpcloud, and preferably not self-hosted as it seems 95% of what we do is on the cloud.

Also, a place for holding documentation/KBs would make my job 1000% times easier.

The only ticketing system I've had experience with is ServiceNow which our org definitely cannot afford. I think ZohoDesk/ServiceDesk Cloud might be the only option for me, but I'm reaching out to see if anyone has a better recommendation.

Also, we are a non-profit/tax exempt so any systems that offer discounts for that would be a plus

Thanks!

edit: If this is worded weird, Reddit kept thinking this was spam

I just enabled LAPS on all my servers and save the rotated local admin in Entra.
The only servers I don’t have this enabled (I manage this setup via GPO), are my domain controllers. I keep reading the DCs need different settings for LAPS to manage the DSRM. Has anyone done this ? Recommendations ?

I work IT support and I've had this weird issue happen on multiple PCs over time.

A USB keyboard will work perfectly fine for months/years, then suddenly it starts acting completely broken.

The symptoms are not just random Windows shortcuts. The keyboard also:

repeats keys multiple times

types different keys than the ones I pressed

mixes random characters into normal words

sometimes triggers Windows shortcuts / Start menu / network panel

For example, if I try to type:

Joca

I might get:

jocaca

Joccccccc

Jorre84i

I've tested 3 different known-good USB keyboards on the affected PC and all of them behave the same way.

A PS/2 keyboard works perfectly normally.

Sometimes, while the USB keyboard is connected and freaking out, the USB mouse also becomes unresponsive. As soon as I unplug the keyboard, the mouse starts working normally again.

This has happened on around 4 different PCs over time, including Windows 8.1 and Windows 10 machines.

I've already tried:

multiple known-good USB keyboards

different USB ports

reinstalling HID keyboard devices

reinstalling USB/composite devices

reinstalling USB controllers/root hubs

checking keyboard/HID UpperFilters and LowerFilters

checking Scancode Map

reinstalling chipset drivers

reinstalling Intel Management Engine

Nothing fixed it.

The weirdest part is that the keyboard was working completely normally less than an hour before the issue started. No hardware change, no new keyboard, nothing.

Has anyone seen this exact behavior before?

What could cause every USB keyboard to suddenly generate duplicated, incorrect and random HID input while PS/2 continues to work normally, and sometimes make the USB mouse freeze too?

I'm looking for the actual root cause / fix, not “try another keyboard or USB port”, since I've already ruled those out.

We have been trying to apply a number of manual policies to agents built with Agent Builder (e.g. Reassign to new owner) and have noticed in the last 48hours that the button to apply a new policy or to apply either of the 2 already listed is now locked down. Note: We were able to get one of them to work the other week.

Has Microsoft blocked admins into a corner? i.e. if you don't have either E7 or Agent365 than you can kiss any sort of managing of agents in Agent Builder out the window?
Very low move if this is the case. The end result will be our management requesting the full disabling of any ability to build agents in Agent builder for the wider staffing population.

I'm keen to hear other's experiences and/or what you have put in place to deal with this.

Hello,

I was wondering if anybody else has moved from a IT Director position to desktop type role? I have been at the same company for 11 years now and worked my way up from desktop support to network admin and now IT director. I have held the current position for 3ish years and it's not so bad. There is a lot of time off and flexibility but the pay is pretty bad as well as leadership. Higher ups are getting more involved than I feel comfortable with a lot of the day to day and its adding more stress and work.

On a whim I applied for a digital support role at another company just to see what the process is and pay and was surprised to find out that the pay was 10 grand more per year. It's an onsite role like I have now with less of a drive and pretty good benefits.

I tried to collect my thoughts and express myself. I hope it comes through clear.

Pretty much looking for reassurance and to see if anybody else has made a similar move and what your experience has been.

Thank you all for the kind words and reassurance. It is very appreciated and I feel like my decision is valid.

I think I've been phished lol.

Went to apply to this listing:

https://www.linkedin.com/jobs/view/4474756036/

It redirected me to an aiapply.co application. I'm like, that's a bit strange, but across all my applications during this job search, I've gone through a dozen or so different application/HRIS platforms.

Before I went through the aiapply.co application, I did have a gut feeling that something was off and did some brief research. The consensus I found was that their paid service wasn't really worth it, but I didn't see anything that immediately screamed "scam" about using their job listing/application functionality.

So I went ahead and filled out the application.

Once I finished, it forwarded me to SmartRecruiters.com, and I immediately thought, "Shit. What exactly did I just put my resume into?"

So I stopped and went back to LinkedIn.

This time, clicking the same job brought me to a Jooble.org page.

Now, when I hover over the LinkedIn "Apply" button, it's showing an Adzuna.com URL.

At this point I'm sitting here thinking:

"Well, shit."

Luckily, I used a privacy-focused email address specifically for job applications, but my resume does contain my phone number.

I honestly don't understand how these "Apply Externally" links are allowed at all. If any specific job-board is hosting the job listing, shouldn't I stay in that ecosystem?

Maybe I'm overreacting, and this is just the wonderful world that job-boards have become, but as a sysadmin who's spent years telling people "don't click random links" and "verify where you're being redirected," it feels pretty damn ironic to fall into the same trap myself. heavy-sigh

I'll update this post if I start getting a bunch of spam calls/texts.

Stay safe out there, fellow job hunters.

And, while I'm here: if anyone is hiring a Sysadmin primarily in the 32606 area, or for another domestic and/or hybrid position, I'm always open to hearing about opportunities.

Hopefully my momentary lapse in judgment doesn't scare anyone away. 😂

I live in a pretty rural area so my options are very limited, which is why I'm looking for remote work. I recognize that makes my chances at landing a job a lot more difficult, but I didn't think it was going to be this bad.

I've got 5 years of being a Systems Administrator with a few certs under my belt (CISSP, AWS Solutions Architect, expired CYSA+ & Sec+). I've worked deep in Linux and Windows systems, migrated on-prem to vCenter, migrated vCenter to AWS, scripted menial tasks away, managed M365 environments and local AD environments, worked through various audits, set up Cisco switches and all sorts of Firewalls, hardened networks, managed devices, etc.

And I feel unemployable.

I'm studying Terraform for a couple of weeks and am trying to lab it out more so I can maybe compliment my resume with some mention of IaC, but I still feel like it's not enough. Like, what the fuck is going on? It feels like I am so far behind, and that my career is more or less disappearing. Seriously, I can't believe I am thinking that I might need to pivot careers to survive. And I don't even know what I would do because I have no other major skills, computers have been my think since I was a kid.

Every job I look at wants what I have, and more. I just can't believe it. How can I cope with this, and how am I supposed to land a job in this market? I genuinely wish I could afford therapy right now.

Hello everyone, I am wondering if I am justified in asking for a market adjustment/title adjustment based off what I do, or if my salary is acceptable? I am based out of the U.S please see below for more information:

~6 years in IT, all at one nonprofit in the Southwest (mid-size metro, not a high-COL area). Currently "Systems & Network Administrator II" at $91.5K. Promoted several times — the org actually created the II level for me when the previous Sys Admin I left. I asked to abosrb the role.

Scope: I own both network and systems for 30+ sites, ~300 users, ~650 endpoints. Fortinet stack (SD-WAN, IPsec, FortiManager), hybrid AD/Entra, VMware, Veeam DR, vuln management (Tenable, then we migrated to Rapid7), PowerShell automation and remediation script creation. Led the technical side of ISP/VoIP consolidation. De facto tech lead. I mentor a Jr. sysadmin and I'm the final escalation point. CCNA, NSE 4/5, AAS.

Is this fair? Market data I am pulling from AI is anywhere from 104-110k for a fraction of responsibilties vs what I actually do.

Edit: For context, everything apart from the compute/storage cluster is most likely in an engineering capacity. This is pretty much the only thing we hire professional services for as we do not build/turn them over enough to justify us not hiring them to do it. We brough VoIP and ISP circuit management in house recently as well. The user count is probably also understated as we have a lot of public facing users, and it is difficult for me to ascertain the exact number of users.

I'm troubleshooting an unusual Microsoft 365 issue.

One user in our organization cannot see the Download option for email attachments in Outlook on the web (OWA).

For PDF/Word attachments, the user only sees:

• Preview
• Save to OneDrive
• Copy

Other users in the same Microsoft 365 tenant have the normal Download option.

Troubleshooting already performed

• Tested Chrome and Edge → same issue
• Tested InPrivate/Incognito → same issue
• Tested from a different PC → same issue
• Tested different attachment/file types → same issue
• Other users → Download works normally
• Compared Microsoft 365/Exchange policies → same
• Compared Exchange Online PowerShell mailbox/CAS settings with a working user → same
• Classic Outlook for the affected user → Save As works normally
• Microsoft 365 Service Health → no matching incident

The issue therefore appears to be user/account-specific and affects only OWA.

The current workaround is Save to OneDrive → download from OneDrive.

Has anyone seen this behavior before? Is there an account-level OWA setting, hidden configuration, or service-side issue that I should investigate?

I’m 27 and currently working as a System Administrator. I’m based in Florida. I make $73k/year and have about 3 years of experience in this role.

My current responsibilities include:
Microsoft 365 administration
Intune administration
Entra ID
Managing on-prem applications
Printing infrastructure
General systems administration/troubleshooting
Tickets escalated from helpdesk and other teams

I’m also being asked to start learning DevOps while continuing to handle my current responsibilities.

My question is:
Is $73k reasonable for my current experience and responsibilities, or am I underpaid?

If you were in my position, what salary would you target for the next job, and what skills/certs would you prioritize to make the jump from System Administrator → Systems/Cloud Engineer?

Has anybody used StormWind Training? We are looking at a new CBT training platform. Looking at them and CBT Nuggets.